# suCGI build configuration for production.
# Use "addcflags [COMPILER ...] FLAG [...]" to add compiler flags.
# Use "addcppflags FLAG [...]" to add C preprocessor flags.
# Use "addldflags [COMPILER ...] FLAG [...]" to add linker flags.

# TODO: Add once suCGI is mature.
#addcppflags -DNDEBUG

# Use ISO/IEC 9899:1999 C. Some compilers require this flag.
addcflags -std=c99 -pedantic

# Optimise the build. Required for instrumentation.
addcflags -O2

# Make code position-independent.
addcflags -fPIC -fPIE
addldflags -pie

# Enforce __attribute__((nonnull(...))).
addcflags -fisolate-erroneous-paths-attribute

# Fail on floating point overflow.
addcflags -ftrapv -fstrict-overflow \
          -fp-trap=invalid,overflow,underflow,denormal \
          -fsanitize=integer

# Enable link time optimisation.
# Required for -fsanitize=cfi by clang, but a good idea at any rate.
addcflags -flto

# Enable control flow protection.
addcflags -fcf-protection=full -fsanitize=cfi

# Enable the stack protector.
addcflags -fstack-protector -fstack-protector-strong \
          -fsanitize=safe-stack -fstack-security-check 

# Protect against stack clashing attacks.
addcflags -fstack-clash-protection

# Enable hardening.
addcflags -fhardened

# Check for (some) undefined behaviour.
case ${CC-} in
(musl-*)    # musl-gcc and musl-clang sometimes have trouble linking UBSan.
            : ;;
(*)         addcflags -fsanitize=undefined -static-libubsan
esac

# TODO: Remove once suCGI is mature.
# Check for (some) addressing bugs.
case ${CC-} in
(musl-*)    # musl-gcc and musl-clang sometimes have trouble linking ASan.
            : ;;
(*)         addcflags -fsanitize=address -static-libasan \
                      -fsanitize=pointer-compare -fsanitize=pointer-subtract
esac

# Turn warnings into errors if the compiler supports error-suppression.
addcflags gcc clang icc -Werror -Werror-all -pedantic-errors

# Warn about type conversions.
addcflags -Wincompatible-pointer-types -Wconversion -Wsign-conversion

# Disable uninformative warnings.
addcflags -Wno-unknown-warning-option -Wno-unused-command-line-argument \
          -Qunused-arguments

# Disable diagnostics for unknown pragmas for ICC,
# which claims to be compatible with GCC and Clang, but isn't.
addcflags icc -diag-disable=161,2282

# Disable ICC deprecation warning.
addcflags icc -diag-disable=10441

# Needed by icc to compile the test suite.
addcflags icc -no-inline-max-size -no-inline-max-total-size

# Speed up compilation.
addcflags -pipe

# Make the global offset table read-only.
addldflags -Wl,-z,relro -Wl,-z,now

# Load local settings.
if [ -e "$repodir/conf/local.env" ]
then . "$repodir/conf/local.env"
fi
